Who are we?
Look at the latest headlines and you will see something Ki insures. Think space shuttles, world tours, wind farms, and even footballers' legs. Ki's mission is simple: digitally disrupt and revolutionise a 335-year-old market. Working with Google and UCL, Ki has created a platform that uses algorithms, machine learning and large language models to give insurance brokers quotes in seconds, rather than days.
Responsibilities
•Provide practical implementation advice and guidance on securing AI-powered applications, aligning with frameworks like OWASP ASVS and the OWASP Top 10 for LLM Applications.
•Lead threat modelling sessions for AI and agentic systems during the technical design phase using STRIDE and AI-specific frameworks.
•Establish secure guardrails, allowlists, telemetry, and safe-by-default configurations for developer AI tooling.
•Manage security testing workflows in the SDLC, utilizing scanners to check for standard and AI-specific risks such as prompt injection and data leakage.
•Coordinate regular penetration tests, vulnerability triage, and cloud security posture management across GCP and Azure platforms.
•Automate security tasks by contributing code to infrastructure and security tooling around our cloud platforms.
•Foster secure practices by facilitating the Security Champions network, organizing security discussions, and delivering AI tooling safety training.
•Share expertise, document processes, and mentor team members to build security capability across engineering.
•Provide constructive feedback on Ki's architecture and lead technical security discussions.
Requirements
•Strong ability to write and review code (preferably in Python, TypeScript, Kotlin and Terraform), with a background in software development, SRE, DevOps, or practical security engineering.
•In-depth understanding of securing AI/LLM applications, agentic tooling, and developer AI tools, including prompt injection mitigation, model integration risks, guardrails, telemetry, and the use of frontier models via APIs or locally.
•Practical experience with agentic development using coding harnesses is essential.
•Solid knowledge of major public cloud providers (preferably Google Cloud Platform, with Azure or AWS as beneficial) and network infrastructure.
•Solid understanding of the Kubernetes ecosystem, Docker, and container security.
•Experience implementing and managing security testing programs (SCA, SAST, DAST) within pipelines like GitHub Actions, alongside release packaging and artifact management.
•Capability to develop secure, automated infrastructure using Terraform.
•You enjoy learning about both the offensive and defensive aspects of security.
•Ability to work collaboratively within enterprise-wide agile development environments.
•Outstanding communication skills (both written and verbal), with the ability to explain complex vulnerabilities to technical teams and business stakeholders, share knowledge, and mentor colleagues.
Conditions
You'll get a highly competitive remuneration and benefits package. This is kept under constant review to make sure it stays relevant. We understand the power of saying thank you and take time to acknowledge and reward extraordinary effort by teams or individuals.
